feat(api): spaces routes

Add lib/api/routes/spaces.js: list, create, get-by-id, get-by-slug,
patch, delete. Mounted under /api/spaces. Server smoke restored.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

lib/api/index.js

@@ -1,12 +1,13 @@
 import { Router } from 'express';
 import { ownerOnly } from '../auth/owner.js';
 import { errorMiddleware, NotFoundError } from './errors.js';
+import { router as spacesRouter } from './routes/spaces.js';
 
 export function mountApi(app) {
   const api = Router();
   api.use(ownerOnly);
 
-  // route modules registered here as Plan 2 progresses
+  api.use('/spaces', spacesRouter);
 
   api.use((_req, _res, next) => next(new NotFoundError('route not found')));